Re: [PATCH bpf-next 1/2] bpf: Validate outgoing stack args when btf_prepare_func_args fails

[Yonghong Song <yonghong.song@linux.dev>]

On 5/15/26 1:53 AM, Alexei Starovoitov wrote:
> On Thu May 14, 2026 at 12:37 PM PDT, bot+bpf-ci wrote:
>>> commit 284cf62e75bd5632d61c528e48fe3f738870b269
>>> Author:     Yonghong Song <yonghong.song@linux.dev>
>>>
>>>      bpf: Validate outgoing stack args when btf_prepare_func_args fails
>>>
>>>      btf_prepare_func_args() sets sub->arg_cnt before validating arg types.
>>>      If validation fails (e.g. unsupported pointer type in a static subprog),
>>>      check_outgoing_stack_args() is skipped because btf_check_func_arg_match()
>>>      returns early. For static subprogs, check_func_call() ignores non-EFAULT
>>>      errors and proceeds with the call.
>>>
>>>      This causes the callee to read stack arg slots that the caller never
>>>      stored or not initialized, potentially dereferencing NULL caller->stack_arg_regs
>>>      or getting no-initialized value.
>>>
>>>      To fix the issue, when btf_prepare_func_args() fails and the subprog expects
>>>      stack args, call check_outgoing_stack_args() to verify the caller initialized
>>>      the slots. Return -EFAULT on failure so the error is not ignored.
>>>
>>>      Reported-by: Sashiko <sashiko-bot@kernel.org>
>>>      Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> This looks like a bug fix for stack argument handling. Should this include:
>>
>>    Fixes: 3ab5bd317ee2 ("bpf: Set sub->arg_cnt earlier in btf_prepare_func_args()")
> fixes tag is necessary indeed, but please drop 'Reported-by: Sashiko'.
> If we start doing such things every patch will have it.

Thanks. Will add fixes tag and drop 'Reported-by: Sashiko'.